maps_scanner

MAPS Cloud Scanner A research tool for interacting with Windows Defender's MAPS Microsoft Active Protection Service cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender's real-time protection verdicts, sample submission pipeline, and...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

WDExtract

WDExtract Extract Windows Defender database from vdm files and unpack it This program is distributed as-is, without any warranty; No official support, if you like this tool, feel free to contribute. Features Unpack VDM containers of Windows Defender/Microsoft Security Essentials; Decrypt VDM...

onelinepy

onelinepy Python Obfuscator for FUD Python Code. Download & Run git clone https://github.com/spicesouls/onelinepy cd onelinepy chmod +x setup.sh ./setup.sh onelinepy Usage Guide | || | . | | -| | | | -| . | | |Python |||||||||| | |Obfuscator || || usage: oneline.py -h -m M -i I --script SCRIPT...

charlotte

charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

nim-shell

Nim-Shell Reverse shell that can bypass EDR and windows defender detection Please do not upload to VirusTotal 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗥𝗨𝗖𝗧𝗜𝗢𝗡𝗦 $ apt install nim Compilation nim c -d:mingw --app:gui nimshell.nim Change the IP address and port number you want to listen to in the nimshell.nim file accordin...

CVE-2022-30190-follina

CVE-2022-30190-follina Just another PoC for the new MSDT-Exploit To edit the Doc, just open with 7z, xarchiver, ... to change the value in word\rels\document.xml.rels to your IP. The exploit must contain at least 3541 characters before the window.location.href, and they must be within the script...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

Nim-Reverse-Shell

Nim Reverse Shell A simple reverse shell written in Nim that bypasses Windows Defender detection see the "Tested Operating Systems" section below for more details. This code is made for educational purposes only. Tested Operating Systems Windows 10 10.0.19045 Windows 11 10.0.22621 Compilation The...

CVE-2017-8625_Bypass_UMCI

what is ! Windows Defender Device Guard ! Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity...

SNEK_Equinox

SNEK Equinox I would like to thank Nightmare-Eclipse for the inspiration not personal from the project UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Now funnily enough, I found a way to lie to the EDR web console to show that defender is up a...

WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry Код на C++ для постоянного отключения Windows Defender через ключи реестра Просто скомпилируйте и запустите! И после перезагрузки: BYOVDWindowsDefenderKiller Этот модуль реализует технику BYOVD Bring Your Own Vulnerable Driver для отключения Windows...

CVE-2017-0290-

CVE-2017-0290- Hello i,am Gihad Alkmaty froom Libya script CVE-2017-0290- specialist smash Windows DEFINDER windows/8.1/10/...

nim-shell

Nim-Shell Shell inversé capable de contourner la détection EDR et Windows Defender Veuillez ne pas télécharger sur VirusTotal 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗥𝗨𝗖𝗧𝗜𝗢𝗡𝗦 $ apt install nim Compilation nim c -d:mingw --app:gui nimshell.nim Modifiez l'adresse IP et le numéro de port que vous souhaitez écouter dans le...

exch_CVE-2021-42321

exchCVE-2021-42321 This is the tool involved in the 7bits security team article "DotNet Security - CVE-2021-42321 Reproduction" Change the TypeConfuse chain to write to file, bypass Windows Defender to disable the w3wp.exe startup process. Overwrite the original ysoserial.net file with this file,...

ATP-PowerShell-Scripts

ATP-PowerShell-Scripts Подписанные Microsoft PowerShell-скрипты Список всех подписанных скриптов, доступных в C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection Доступ к файлу По умолчанию файлы недоступны. Требуется привилегия TrustedInstaller...

Defender_Exclusions-BOF

Исключения Defender BOF Что BOF для определения исключений Windows Defender: Расширения Процессы Папки Зачем Примеры использования компилятора C++ для создания BOF без необходимости промежуточных разыменований vtable. Сборка cd src make all Использование 1. Загрузите dist/cEnumerateDefender.cna 2...

StopDefender

StopDefender Остановите Windows Defender программно, создав новый токен с использованием учетных записей служб TrustedInstaller и Windefend. Остановка в одно нажатие: не нужно указывать параметры командной строки или PID. Полезно для интеграции с фреймворками постэксплуатации. Блог...

CVE-2023-36003

CVE-2023-36003 : Preuve de concept de contournement de la protection contre les exploits de Windows Defender Ce dépôt contient une preuve de concept PoC pour CVE-2023-36003 , une vulnérabilité critique de contournement de fonctionnalité de sécurité affectant la protection contre les exploits de...